BSOD when trying to boot in safe mode - Windows 7 x86

T

tjsepka

Contributor
Joined
Apr 6, 2016
Posts
169
Location
Crystal Lake, Illinois
I encounter a BSOD when trying to boot into safe mode. If I have the Windows installation CD in the drive, safe mode is entered showing the Windows installation screen.

OS - Windows 7 SP1 · x86 (32-bit)

· What was original installed OS on system - yes

· The OS a full retail version (purchased it from retailer)?

· Age of system (hardware): constructed from components on 2011-02-17?

· Age of OS installation - have you re-installed the OS? No.

· CPU: AMD Phenom X4 9750 2.4 GHz 4MB

· Video Card: Nvidia GeForce GT 430

· MotherBoard: ECS A740GM-M

· Power Supply: generic 450W

· System Manufacturer: assembled from components

· Exact model number: N/A

· Desktop

Relevant files are attached.
 

Attachments

Hi. . .

The VERIFIER_ENABLED dump flagged an old Vista-era Advanced Audio FX Driver -
Code: 
P1370Afx.sys Mon Apr 02 01:12:02 2007 (461090A2)

It needs to be updated, but I have no driver update site for you.

The other dumps did not mention the Advanced Audio FX Driver.

I don't know why your system would BSOD in safemode and not normal mode -- it's usually the opposite.

Regards. . .

jcgriff2

NOTE: I am recovering from major surgery (double hip replacement) and may not be able to promptly reply to your thread. Thank you for your patience and understanding.

Code: 
[font=lucida console]
Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\052316-32651-01.dmp]
Built by: 7601.23418.x86fre.win7sp1_ldr.160408-2045
Debug session time: Mon May 23 20:38:18.619 2016 (UTC - 4:00)
System Uptime: 0 days 0:00:14.119
Probably caused by : ntkrpamp.exe ( nt!_output_l+815 )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  0x50_nt!_output_l+815
Bugcheck code 00000050
Arguments 80787000 00000000 82ad7a62 00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\052316-41995-01.dmp]
Built by: 7601.23418.x86fre.win7sp1_ldr.160408-2045
Debug session time: Mon May 23 18:47:38.290 2016 (UTC - 4:00)
System Uptime: 0 days 0:00:14.164
Probably caused by : ntkrpamp.exe ( nt!_output_l+815 )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  0x50_nt!_output_l+815
Bugcheck code 00000050
Arguments 80787000 00000000 82ad7a62 00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\053016-34569-01.dmp]
Built by: 7601.23418.x86fre.win7sp1_ldr.160408-2045
Debug session time: Mon May 30 11:58:15.292 2016 (UTC - 4:00)
System Uptime: 0 days 0:12:05.227
*** WARNING: Unable to verify timestamp for P1370Afx.sys
*** ERROR: Module load completed but symbols could not be loaded for P1370Afx.sys
Probably caused by : P1370Afx.sys ( P1370Afx+1bc3 )
DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
BUGCHECK_STR:  0xc4_0
DEFAULT_BUCKET_ID:  VERIFIER_ENABLED_VISTA_MINIDUMP
PROCESS_NAME:  audiodg.exe
FAILURE_BUCKET_ID:  0xc4_0_VRF_P1370Afx+1bc3
Bugcheck code 000000C4
Arguments 00000000 00000000 00000000 00000000
BiosVersion = 080015 
BiosReleaseDate = 08/16/2010
SystemManufacturer = ECS                   
SystemProductName = A740GM-M
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\060416-49920-01.dmp]
Built by: 7601.23418.x86fre.win7sp1_ldr.160408-2045
Debug session time: Sat Jun  4 17:30:13.232 2016 (UTC - 4:00)
System Uptime: 0 days 0:00:11.294
Probably caused by : ntkrpamp.exe ( nt!_output_l+815 )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  0x50_nt!_output_l+815
Bugcheck code 00000050
Arguments 80787000 00000000 826d4a62 00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Loading Dump File [C:\Users\PalmDesert\_jcgriff2_\dbug\__Kernel__\051616-45396-01.dmp]
Built by: 7601.23418.x86fre.win7sp1_ldr.160408-2045
Debug session time: Mon May 16 12:52:22.713 2016 (UTC - 4:00)
System Uptime: 0 days 0:00:13.587
Probably caused by : ntkrpamp.exe ( nt!_output_l+815 )
DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
BUGCHECK_STR:  0x50
PROCESS_NAME:  System
FAILURE_BUCKET_ID:  0x50_nt!_output_l+815
Bugcheck code 00000050
Arguments 80787000 00000000 82ae0a62 00000000
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
  
[/FONT]
 
Last edited:
The faulting driver P1370Afx.sys, which is for my Creative Live! Cam Voice, was a beta version, so I replaced it with the previous, non-beta version and the BSOD still happened. The dump file with the beta driver is older than the one containing the non-beta version. The non-beta driver dump file is 060416-49920-01.dmp. Nirsoft BlueScreenView doesn't seem to give me any insight to the BSOD cause for this dump file. It did identify the P1370Afx.sys driver as the cause of the earlier BSOD. Any suggestions would be appreciated! I'd appreciate it if you could recommend any other tools I might use for this type of debugging. Again, thanks in advance for any help you can provide!

Best of luck with your hip replacement recovery. Rest assured that medical technology has made tremendous advances in joint replacement over the years. I know several people that have recently had knee replacements and their recovery is much faster than what it was in the past. The surgery is much less invasive these days, and physical therapy during the recovery process has also advanced. Personally, I'm hoping that advances in stem cell technology might allow me to forgo a much needed knee replacement. I though it was a pipe dream on my part, but lo and behold, I'm beginning to see it advertised as a possibility.
 
Hi tjsepka. :smile9:

(Good luck John!)

Your perfmon and msinfo32 show errors about officejet 4500 g510n-z and NVidia high definition audio (you could probably find this one on your motherboard manufacturer website).
Perfmon also shows you aren't using an antivirus (are you?) and memory (RAM) is very occupied: maybe you could disable some things at windows startup.
Searching on internet, I've found someone had your same problem and he solved it through malware scans (with MS security essentials) and sfc /scannow in safe mode with command prompt (see tomshardware.co.uk - Computer crashes in safe mode - Windows 7 - (click)).
 
The error for the officejet is for its FAX capability and since I don't have a land line, I can't use the fax so I don't load its driver. The NVidia HD audio driver is only useful for cards which have a HDMI output jack and since mine doesn't have one, I don't load the drivers. I don't think either of these drivers being missing is causing the BSOD. This thread was started from another I have going in Windows Update:
[h=2]Need help to repair damaged files in sxs directory[/h]sfc /scannow wasn't able to correct all of the problems so we're trying into safe mode with the GUI, in order to run Windows Repair All-In-One. When trying to boot into safe mode, I get the symptoms described above (I encounter a BSOD when trying to boot into safe mode. If I have the Windows installation CD in the drive, safe mode is entered showing the Windows installation screen.). From what I've gathered from that thread, I can't run the repair tool in safe mode without the GUI.

I recall going as far as doing an in-place repair (or was it an upgrade?) and it failed, but I haven't tried that in a while since fixing my sxs problems. My gut is telling me the repairs I've made to all of the sxs stuff is probably unrelated to the safe mode BSOD. I believe I've also tried:
bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd

I was hoping the crash data might give me some insight to the root cause, because it seems everything I've tried to this point was just hoping something I do will fix the problem. Any further ideas? Are there tools you might point me to so I might see or help in finding the root cause? I've used nirsoft tools and numerous other utilities so I know my way around. I also have a BSEE degree specializing in Computer Engineering and Communication Electronics, post graduate classes, and over 35 years of engineering experience. Thanks again!

Tom
 
You didn't mention if you checked your PC with an antivirus.
Another possible culprit seems to be Roxio software (in the sense: programs like alcohol, daemon tools, clonedrive, have got this reputation to cause bsods on few machines, and probably Roxio is one of them).
 
xilolee said:
You didn't mention if you checked your PC with an antivirus.
Another possible culprit seems to be Roxio software (in the sense: programs like alcohol, daemon tools, clonedrive, have got this reputation to cause bsods on few machines, and probably Roxio is one of them).
Click to expand...

Yes, I've been using antivirus software continuously for many years. I don't know why it didn't show up in the reports. I also switched for a while to Avast when I thought I might have a root kit virus, but nothing showed up. I noticed that it seems that all of my drivers are loaded when trying to safe boot, not just a minimal set. I don't know if this is normal and I haven't found a work-around yet.

I do know that the crash data says it's caused by driver ntkrnlpa.exe, Nirsoft BlueScreenView data: [(070716-59483-01.dmp 7/7/2016 12:11:30 PM PAGE_FAULT_IN_NONPAGED_AREA 0x00000050 0x80787000 0x00000000 0x82b07a62 0x00000000 ntkrnlpa.exe ntkrnlpa.exe+8e94d NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.23418 (win7sp1_ldr.160408-2045) 32-bit ntkrnlpa.exe+8e94d ntkrnlpa.exe+40fa8 ntkrnlpa.exe+c5a62 ntkrnlpa.exe+c5dcd C:\Windows\Minidump\070716-59483-01.dmp 4 15 7601 135,424 7/7/2016 12:13:02 PM].

Any further ideas on how to proceed in a systematic way to isolate the cause?
 
The updated report files are attached. I also used NeoSmart EasyBCD v2.3 to re-create/repair boot files, but there was no change in the crash behavior. It did give me the ability to boot normally, or to use F8 to bring up the advanced boot options such as booting in safe mode, safe mode with networking, safe mode command prompt, etc.

Tom
 

Attachments

Please remove Auslogics Registry Cleaner, you do NOT need such programs + it is very risky.

Please try following:
  • Open an admin command prompt
  • Copy/paste "sfc /scannow" (without quotes) and press enter
  • When it is finished reboot your system
  • Open again an admin command prompt
  • Enter sfc/scannow again
Let us know what the result of the System File Checker is.

I recommend you update the following drivers:
SahdIa32.sys Tue Oct 28 04:55:58 2008 (49068D4E)
Sonic Solutions HDD Filter Driver (used by many different CD/DVD programs)
http://www.carrona.org/drivers/driver.php?id=SahdIa32.sys

SaibIa32.sys Tue Oct 28 04:56:02 2008 (49068D52)
Sonic Solutions Volume Filter Driver (used by many different CD/DVD programs)
http://www.carrona.org/drivers/driver.php?id=SaibIa32.sys


The following is for information purposes only.
The following information contains the relevant information from the blue screen analysis:
Code: 
**************************Fri Jul 8 17:46:17.295 2016 (UTC + 2:00)**************************[INDENT]Loading Dump File [D:\BSOD\SysnativeBSODApps\070816-49608-01.dmp] 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible 
Built by: [B]7601[/B].23418.x86fre.win7sp1_ldr.160408-2045 
System Uptime:[B]0 days 0:00:11.795[/B] 
Probably caused by :[B]ntkrpamp.exe ( nt!_output_l+815 )[/B] 
BugCheck [B]50, {80787000, 0, 82b1aa62, 0}[/B] 
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#Example"]PAGE_FAULT_IN_NONPAGED_AREA (50)[/URL] 
Arguments: 
Arg1: 80787000, memory referenced. 
Arg2: 00000000, value 0 = read operation, 1 = write operation. 
Arg3: 82b1aa62, If non-zero, the instruction address which referenced the bad memory 
address. 
Arg4: 00000000, (reserved) 
BUGCHECK_STR: 0x50 
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT 
PROCESS_NAME: System 
FAILURE_BUCKET_ID: [B]0x50_nt!_output_l+815[/B] 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` [/INDENT]
--- E O J --- 2016 Jul 09 10:30:13 AM template Copyright 2013 Mikael Pryor
 
Checking your RAM for errors with memtest is usually a good start for bad address references, such as these you are experiencing.
A Kernel dump from C:\Windows\MEMORY.dmp would help a lot, compared to the small minidumps you have.
 
SaibSVC: C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
SahdIa32 (Sonic Solutions)
SaibIa32 (Sonic Solutions)
SaibVd32 (Sonic Solutions)
Click to expand...

Another minidump shows:

BugCheck C4, {f6, 8, aac0ad28, 86cdbb29}
*** WARNING: Unable to verify timestamp for snapman.sys
*** ERROR: Module load completed but symbols could not be loaded for snapman.sys
Probably caused by : snapman.sys ( snapman+6792 )

DRIVER_VERIFIER_DETECTED_VIOLATION (c4)
A device driver attempting to corrupt the system has been caught. This is because the driver was specified in the registry as being suspect (by the administrator) and the kernel has enabled substantial checking of this driver. If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will be among the most commonly seen crashes.
Click to expand...
 
Driver Verifier flagged snapman.sys - Acronis - Driver Reference Table - snapman.sys

Update to the latest version or remove entirely.

Regards. . .

jcgriff2

`

NOTE: I am recovering from major surgery (double hip replacement) and may not be able to promptly reply to your thread. Thank you for your patience and understanding.
 
axe0 said:
Please remove Auslogics Registry Cleaner, you do NOT need such programs + it is very risky.

Please try following:
  • Open an admin command prompt
  • Copy/paste "sfc /scannow" (without quotes) and press enter
  • When it is finished reboot your system
  • Open again an admin command prompt
  • Enter sfc/scannow again
Let us know what the result of the System File Checker is.

I recommend you update the following drivers:
SahdIa32.sys Tue Oct 28 04:55:58 2008 (49068D4E)
Sonic Solutions HDD Filter Driver (used by many different CD/DVD programs)
http://www.carrona.org/drivers/driver.php?id=SahdIa32.sys

SaibIa32.sys Tue Oct 28 04:56:02 2008 (49068D52)
Sonic Solutions Volume Filter Driver (used by many different CD/DVD programs)
http://www.carrona.org/drivers/driver.php?id=SaibIa32.sys


The following is for information purposes only.
The following information contains the relevant information from the blue screen analysis:
Code: 
**************************Fri Jul 8 17:46:17.295 2016 (UTC + 2:00)**************************[INDENT]Loading Dump File [D:\BSOD\SysnativeBSODApps\070816-49608-01.dmp] 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible 
Built by: [B]7601[/B].23418.x86fre.win7sp1_ldr.160408-2045 
System Uptime:[B]0 days 0:00:11.795[/B] 
Probably caused by :[B]ntkrpamp.exe ( nt!_output_l+815 )[/B] 
BugCheck [B]50, {80787000, 0, 82b1aa62, 0}[/B] 
BugCheck Info: [URL="http://www.carrona.org/bsodindx.html#Example"]PAGE_FAULT_IN_NONPAGED_AREA (50)[/URL] 
Arguments: 
Arg1: 80787000, memory referenced. 
Arg2: 00000000, value 0 = read operation, 1 = write operation. 
Arg3: 82b1aa62, If non-zero, the instruction address which referenced the bad memory 
address. 
Arg4: 00000000, (reserved) 
BUGCHECK_STR: 0x50 
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT 
PROCESS_NAME: System 
FAILURE_BUCKET_ID: [B]0x50_nt!_output_l+815[/B] 
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨`` [/INDENT]
--- E O J --- 2016 Jul 09 10:30:13 AM template Copyright 2013 Mikael Pryor
Click to expand...



I've uninstalled Auslogics registry cleaner as advised.

In terms of running sfc /scannow, this has been problematic and my attempts are documented here:

https://www.sysnative.com/forums/wi...elp-repair-damaged-files-sxs-directory-4.html

The BSOD is preventing me from proceeding with the recommendation in that thread.

I tried updating the drivers you listed as best I can, and I'm wondering about the info posted by user xilolee #12. I'm wondering if the drivers are left over from trying out Roxio's disaster recovery product. I uninstalled it as it didn't meet my needs. Interestingly enough, the Sonic (Roxio) drivers you suggested I update and not listed in device manager for my CDRom/DVD. They are listed as drivers for my internal hard drive as well as my external USB backup drive.

I was able to generate a ntbtlog.txt file that I believe is from the latest BSOD and it's attached.
 

Attachments

Jared said:
Checking your RAM for errors with memtest is usually a good start for bad address references, such as these you are experiencing.
A Kernel dump from C:\Windows\MEMORY.dmp would help a lot, compared to the small minidumps you have.
Click to expand...

Thank you for your suggestion. I have run memtest numerous times, and memory has yet to show up as an issue. The BSOD memory fault data has always been consistent rather than random, but I know this is possible if a memory fault is systemic (I'm a hardware guy but have done more than my share of breaking and debugging embedded firmware).

I have a memory dump but it's 96 MB and is probably to big to upload here, but I haven't tried. I you want me to try uploading it, please let me know. I can also upload it to my GoogleDrive and send you the link.

Thanks again,
Tom
 
The dump xilolee is talking about is from at least month ago.

I was wondering if you've ever used Acronis to recover your system, Acronis isn't quite the most stable backup & recovery software, rather one of the most unstable IMO.
 
Yes, I did use it to do a recovery after I discovered my disk was developing read errors and replaced it. The only thing I will say about their software is that it popped up a sector read error during backup, whereas Windows gave me no indication that the drive was failing. When I finally got around to acting on the warnings and checked the system log under Windows Computer Management, I saw that the erroring had been going on for some time without notification. I attached a pop-up event to let me know when disk errors are detected.

Without going into details, you are correct in your assessment of Acronis True Image Home. The deficiencies I found in the product make it, IMO, not fit for purpose.

I have since been transitioning to AOMEI Backupper (free edition), and so far I'm impressed with it in comparison to Acronis. Are you aware of AOMEI and have any opinion? It's worth looking at if you have ever used Acronis TIH.
 
Hi Tom,

To me, based on that full memory dump (dated Sat Jul 9 01:35:28.021 2016 (UTC - 4:00)), I still think Roxio is at fault.

The basic 0x9f info:
Code: 
DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time.Arguments:
Arg1: [COLOR=#daa520]00000003[/COLOR], A device object has been blocking an Irp for too long a time
Arg2: 8616f610, Physical Device Object of the stack
Arg3: 83778ae0, nt!TRIAGE_9F_POWER on Win7 and higher, otherwise the Functional Device Object of the stack
Arg4: [COLOR=#00ff00]87047638[/COLOR], The blocked IRP

WinDbg says: "Probably caused by: atapi.sys" (generic response)

Let's check the blocked IRP:
Code: 
0: kd> !irp [COLOR=#00ff00]87047638[/COLOR]
Irp is active with 6 stacks 5 is current (= 0x87047738)
 No Mdl: No System Buffer: Thread 00000000:  Irp stack trace.  
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    
            Args: 00000000 00000000 00000000 00000000

 [  0, 0]   0  0 00000000 00000000 00000000-00000000    
            Args: 00000000 00000000 00000000 00000000

 [  0, 0]   0  0 00000000 00000000 00000000-00000000    
            Args: 00000000 00000000 00000000 00000000

 [  0, 0]   0  0 00000000 00000000 00000000-00000000    
            Args: 00000000 00000000 00000000 00000000

[COLOR=#0000ff]>[ 16, 2]   0 e1 87b71030 00000000 00000000-00000000    pending
           \Driver\cdrom
            Args: 00015400 00000001 00000004 00000003
[/COLOR]
 [  0, 0]   0  0 00000000 00000000 00000000-88e04808    
            Args: 00000000 00000000 00000000 00000000

Well, knowing it's the CD-ROM is partially useful, we can try looking into its driver from here:
Code: 
0: kd> !drvobj [COLOR=#0000ff]\Driver\cdrom[/COLOR]
Driver object (8709e8e8) is for:
 \Driver\cdrom
Driver Extension List: (id , addr)
(8cd42425 8789b638)  
Device Object list:
[COLOR=#40e0d0]8875a6a8[/COLOR]  87b71030 
 
0: kd> !devobj [COLOR=#40e0d0]8875a6a8[/COLOR]
Device object (8875a6a8) is for:
 CdRom1 \Driver\cdrom DriverObject 8709e8e8
Current Irp 00000000 RefCount 0 Type 00000002 Flags 00002052
Vpb 88750748 Dacl 8f0b37c4 DevExt 8875a190 DevObjExt 8875a780 Dope 8876a158 
ExtensionFlags (0x00000800)  DOE_DEFAULT_SD_PRESENT
Characteristics (0x00000101)  FILE_REMOVABLE_MEDIA, FILE_DEVICE_SECURE_OPEN
AttachedTo (Lower) 88791018*** ERROR: Module load completed but symbols could not be loaded for [B][COLOR=#ff0000]PxHelp20.sys[/COLOR][/B]
 \Driver\PxHelp20
Device queue is not busy.

So I ran lmvm on PxHelp20:
Code: 
0: kd> lmvm PxHelp20
start    end        module name
8cf46000 8cf4f520   PxHelp20   (no symbols)           
    Loaded symbol image file: [COLOR=#ff0000]PxHelp20.sys[/COLOR]
    Image path: [COLOR=#ff0000][B]\SystemRoot\System32\Drivers\PxHelp20.sys[/B][/COLOR]
    Image name: PxHelp20.sys
    Timestamp:        Thu May 12 13:16:28 2011 (4DCC15EC)
    CheckSum:         00015341
    ImageSize:        00009520
    File version:     3.0.95.0
    Product version:  2.0.0.0
    File flags:       0 (Mask 3F)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Rovi Corporation
    ProductName:      PxHelp20
    InternalName:     PxHelp20
    OriginalFilename: PxHelp20.sys
    FileVersion:      3.00.95.0
    FileDescription:  Px Engine Device Driver for Windows 2000/XP
    LegalCopyright:   Copyright © Rovi Corporation or its subsidiaries. All rights reserved.

Here's a list of software known to use PxHelp20.sys.

It could be completely unrelated, but it's my current best guess based on the full dump (don't know when you installed/uninstalled Roxio). Can you check %SystemRoot%\System32\Drivers\ for PxHelp20.sys? If it's there, I would make a system restore point and rename the driver to PxHelp20.old, then try safe mode again.
 
Last edited:
Back
Top